Syed Usfar Wasim
@nCD24DeutschlandCompletionist
0 followers15 downloads736 copies14 likes1,338 views
45 detections
Filters
Last updated
All Time
Detection languages
45
Categories
4
2
2
2
2
Platforms
18
8
3
2
2
Products / Services
4
3
3
1
1
MITRE Techniques
8
7
7
6
6
CVEs
3
3
1
1
1
IDS Classtypes
2
1
This Defender XDR query detects high-confidence attempts to export certificates with private keys using native Windows utilities, PowerShell, Mimikatz, AADInternals, Certipy, OpenSSL, and certificate-management tools.
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
Detection for reported campaign delivering a trojanized, non-digitally signed TrueConf client installer to users connecting to a compromised TrueConf server.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
This query identifies creation/loading of SysExcSvc.dll and SysReadSvc.dll along with suspicious LSASS memory dumping, reverse SSH tunnel creation.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
This KQL is designed to hunt for activity that may indicate Active Directory Certificate Services abuse or Certighost-like domain compromise behavior, especially where an attacker may manipulate machine account attributes, impersonate domain-controller-like behavior, or perform follow-on credential extraction.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
This KQL detects possible impossible travel sign-in patterns by identifying users who had successful Entra ID sign-ins from different countries within a short time window of 4 hours.
This KQL identifies inbound emails that were not blocked and have subject lines commonly associated with phishing or social engineering lures along with a URL and/or attachment
Page 2 of 5